What to Do When Defender Quarantines a File

Updated on Oct 18, 2026 | by Qiling

Quick Navigation:

Check Protection History First
Do Not Reintroduce Malware
Scan Only a Confirmed Safe Deleted File
Prefer a Clean Replacement
Frequently Asked Questions

A quarantined item is intentionally isolated because Windows Security considered it risky. Do not treat quarantine as ordinary accidental deletion or restore an unknown threat simply to make a file reappear.

Check Protection History First

Open Windows Security and review Protection History for the file, path, threat name and action. A quarantined item, a removed threat and a false positive are different situations.

If the file came from an untrusted attachment or installer, leave it quarantined. Obtain a clean version from its original publisher. For a personal document you believe is safe, ask an administrator or security professional to assess the alert.

Do Not Reintroduce Malware

Check a known-good backup or cloud version without opening a suspicious file. Keep security protection enabled.

Only if a verified safe local file was actually removed, rather than still quarantined, should you consider a disk scan. Use a separate output drive and inspect recovered copies safely.

Scan Only a Confirmed Safe Deleted File

Qiling Deep Data Recovery provides a visual scan of storage that Windows can detect. In this case, file scanning does not replace Defender's quarantine controls or a malware assessment. A listed file is only a candidate until you open and verify its recovered copy.

Step 1. Review the Security Event

Identify the action in Protection History. Do not restore or allow the item until its safety is confirmed.

Free Download
Windows 11/10/8/7, 100% Secure

Step 2. Choose a Deletion Scan if Appropriate

For a confirmed safe file removed from local storage, choose Fast Scan. If it remains quarantined, use Windows Security's authorized workflow instead of scanning.

Step 3. Select the Former Source Disk

Choose the physical disk that held the file. Avoid scanning cloud-only data or a quarantine location as though it were an ordinary folder.

Step 4. Inspect Candidates Without Running Them

Filter by file type and name. Do not execute recovered programs or macros; verify provenance and scan output with current security tools.

Inspect recovered file without running it

Step 5. Recover to Controlled Storage

Click Recover for a confirmed safe file, save to a separate disk and have the copy checked before normal use.

Prefer a Clean Replacement

For software installers, download a fresh signed copy from the official publisher rather than recovering a suspicious executable.

If Defender identifies malware again, do not disable protection to keep using it. Investigate the source and restore personal data from a clean backup.

Frequently Asked Questions

Can Deep Data Recovery bypass Defender quarantine?

No. Quarantined items are managed through Windows Security and authorized review.

Should I click Restore on every quarantined item?

No. Restore only after confirming a false positive; otherwise you may reintroduce a threat.

Can a recovered installer be trusted automatically?

No. Prefer a fresh official download and verify signatures and security results.